CVE-2025-11906
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Progress Flowmon versions prior to 12.5.6, certain system configuration files have incorrect file permissions. A user with access to the default flowmon system account (SSH) may potentially escalate privileges to root during service initialization.
Risk Assessment
An attacker with access to the flowmon account could gain root privileges, leading to full system compromise.
Recommendation
Update Progress Flowmon to version 12.5.6 or later.
Other vulnerabilities in Progress Flowmon
See all- CVE-2026-8079High
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, an authenticated low-privileged user can craft a request during PDF generation, leading to operations performed with another user's privileges. This may result in unauthorized access to sensitive data and unintended system configuration changes.
- CVE-2026-3692High
In Progress Flowmon versions prior to 12.5.8, an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.
- CVE-2026-2737Medium
A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.
Original NVD description (English source)
A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS